telmon95/VulneraMCP

> An AI-Powered Bug Bounty MCP Server — recon, vulnerability testing, API/auth/cloud scanning, graph analysis, and reporting for security researchers and bug bounty hunters.
VulneraMCP is a Model Context Protocol (MCP) server for bug bounty hunting and security testing. It integrates OWASP ZAP, optional Caido/Burp Suite, and CLI tools (subfinder, httpx, gau, ffuf) for reconnaissance, JavaScript analysis, XSS/SQLi/IDOR/CSRF testing, API and auth misconfiguration checks, cloud bucket and secret scanning, orchestrated scan flows, knowledge-graph analysis, wordlist generation, and Markdown reporting — with PostgreSQL storage for findings and test results.
## 🎬 Demo
Watch the VulneraMCP demonstration on YouTube: https://youtu.be/wlUvBVNyh74
## 🌟 Features
### 🔍 Reconnaissance Tools
Subdomain Discovery: Subfinder, Amass integration
Live Host Detection: HTTPx for checking active endpoints
DNS Resolution: DNS record enumeration (A, AAAA, CNAME, MX, TXT)
URL Discovery: Gau (Get All URLs) from archives and crawlers
Fuzzing: ffuf for directory, file, and parameter discovery
Full Recon Workflow: Automated multi-tool reconnaissance
### 🔐 Security Testing
XSS Testing: Automated cross-site scripting detection
SQL Injection: SQLi vulnerability testing with sqlmap fallback
IDOR Detection: Insecure Direct Object Reference testing
CSP Analysis: Content Security Policy misconfiguration detection
Auth Bypass: Authentication bypass attempt testing
CSRF Testing: Cross-Site Request Forgery detection with advanced techniques
### 🌐 API Testing
GraphQL: Introspection and misconfiguration checks
Rate Limiting: Endpoint rate limit testing
BOLA / IDOR: Broken object level authorization tests
Mass Assignment: Unsafe field assignment detection
Swagger/OpenAPI: API documentation enumeration
### 🔑 Authentication Testing
JWT: None algorithm and algorithm confusion attacks
OAuth: Misconfiguration detection
Session: Fixation and cookie flag analysis
Password Reset: Host header poisoning tests
MFA: Bypass signal detection and testing
### ☁️ Cloud Security
Storage: S3/Azure/GCP bucket enumeration and permission probes
Secrets: Exposed key scanning in JS, HTML, and env files
Terraform: State file leak detection
### 🎯 Scanner Orchestration
Target Normalization: Standardize targets for multi-tool flows
Run Flow: Orchestrated scanning across API, auth, and cloud tools
Finding Correlation: Link and correlate results across tests
### 📈 Graph Analysis
Knowledge Graph: Store targets, findings, and relationships in PostgreSQL
Pattern Detection: Extract patterns and find similar findings
Attack Graphs: Generate, rank, and export attack paths (JSON, GraphML)
### 📝 Reporting & Wordlists
Report Generation: Markdown reports from findings
Wordlist Generation: Directories, files, parameters, and combined lists
### 📜 JavaScript Analysis
JS Download: Download and analyze JavaScript files
Code Beautification: Format and beautify minified JS
Endpoint Extraction: Find API endpoints and URLs in JS
Secret Detection: Heuristic API key and token extraction
Full Analysis: Combined download, beautify, and analyze workflow
### 🕷️ Integration
Spider Scans: Automated web crawling
Active Scanning: Vulnerability scanning